NLTK corpus readers symlink path traversal bypass

Severity: medium · CVSS 5.9 · Published 2026-08-25

NLTK is a popular Python library for natural language processing used to analyze and process text data. Versions before 3.10.3 contain a vulnerability that allows attackers who can place malicious symlinks within a trusted data directory to read sensitive files outside that directory. An attacker could exploit this to extract confidential information from the system by crafting corpus files that point to protected areas outside the intended data root.

Technologies: nltk (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 5.9, published 25 August 2026.
Which products and versions are affected?
nltk (PyPI) <= 3.10.2.
Is there a fix for This vulnerability?
A patch was published on 2026-08-11: Fix released in version 3.10.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in NLTK's corpus readers (ipipan, crubadan, lin) which derive paths from trusted corpus state and reopen them using Python's built-in open() function instead of nltk.pathsec.open(). This bypasses NLTK's symlink-aware trusted-root security model. An attacker with ability to stage files or symlinks under a trusted NLTK data root can create symlinked corpus inputs (e.g., header.xml, table.txt, simN.lsp) that point outside the root directory. When the corpus reader processes these files through public methods like channels(), domains(), or synonyms(), the symlinks are followed, allowing information disclosure of files outside the intended trusted boundary. The fix involves replacing direct open() calls with nltk.pathsec.validate_path() and nltk.pathsec.open(), which respect the required_root boundary. Patched in version 3.10.3.

Affected products

  • NLTK Project NLTK < 3.10.3

Timeline

  • 2026-08-25: disclosed
  • 2026-08-11: patched: Fix released in version 3.10.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.